MALICIOUS — b24675b11edd7b4a0a1e7e52906a606c7a45c793698314224cb8e2432daca693

MALICIOUS — b24675b11edd7b4a0a1e7e52906a606c7a45c793698314224cb8e2432daca693 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: b24675b11edd7b4a0a1e7e52906a606c7a45c793698314224cb8e2432daca693
SHA-1: f4c599d42f446e1a8533ccafe2c73f4af0e29c42
MD5: 92d4ef2ec98f38eb8699898037946643
imphash: 683b1105f11477b15337eac0e16f858e
ssdeep: 768:rMEIvFGvZEr8LFK0ic46N47eSdYAHwmZGp6JXXlaa5uA:rbIvYvZEyFKF6N4yS+AQmZTl/5
TLSH: T15B379DCE9115C70ECB38DEA1AC04EE9E10BBB85AD0F5B26C2EDAC13E01F0457D855659
Submitted as: b24675b11edd7b4a0a1e7e52906a606c7a45c793698314224cb8e2432daca693
File type: pe · Size: 70376 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (6 of 56 engines)

ClamAV (daily): Win.Malware.Ulise-7170100-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: flagged
Trellix Stinger (McAfee): Dropper-FZK!92D4EF2EC98F
Kaspersky (KVRT): UDS:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-7170100-0 (rule Win.Malware.Ulise-7170100-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Dropper-FZK!92D4EF2EC98F (rule Dropper-FZK!92D4EF2EC98F) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Generic (rule UDS:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://ow5dirasuek.com/, http://mkkuei4kdsz.com/, http://lousta.net/ - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

846 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\omsecor.exe - a4c725aaf2bea1c380068d6c27f4c15571fe4bc74ad110194f678cf7ab244320
C:\Windows\System32\omsecor.exe - 706eb85bf042342836ae4483ab1d5928e42a9001cf6842081dbbb9ae381042c3

Embedded URLs

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://mkkuei4kdsz.com/49/243.html
http://ow5dirasuek.com/948/594.html

Embedded domains

begun.ru
an.yandex.ru
ow5dirasuek.com
mkkuei4kdsz.com
lousta.net

Embedded IP addresses

20.42.73.25
4.230.171.124
4.247.188.233
4.144.132.223
135.233.95.144
135.232.92.97
20.42.65.94
4.150.223.99
193.166.255.171
52.110.12.18
52.110.12.32
92.223.78.30
3.238.30.69
44.192.95.127
40.84.97.4
72.153.5.96
52.148.114.188
52.110.12.14

File paths

C:\WINDOWS\system32\gbdwpbm.dll

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report